Where to find Healthcheck fail info?

How do I see when and why a service was restarted?

At some point over the weekend an idle service in our test environment went down and at some point it was restarted on the same worker. The ELB-> EC2 healthchecks don’t seem to have triggered as the worker instance was not rebooted. So this looks like a problem with our app - either it exited or the Dockerfile-specified HEALTHCHECK failed. How do I find out which and why?

The app’s logs go to CloudWatch but the last entry is (I think) some time before it went down (or was noticed to have gone down) and does not show any errors.

Docker Engine’s logs are not in CloudWatch. sshing to the manager I can see that /var/log/docker*.log[.gz] only goes back 7 hours. Grepping them for ‘health’ returns nothing - are positive healthchecks logged?